FS-DOC-05Technical
Integration and API Spec
NDA Workflow Automation
[YourCompany.com] · Legal Department · Prepared by FullSpec · [Today's Date]
This document defines every integration point in the NDA Workflow automation, covering authentication methods, required API scopes, webhook configuration, field mappings between tools, credential store layout, and error handling behaviour. It is written for the FullSpec build team and assumes familiarity with REST APIs, OAuth 2.0, and webhook signature validation. The automation spans six tools: Notion, Google Drive, Slack, DocuSign, HubSpot, and Gmail. The orchestration layer is referred to throughout as the automation platform. Nothing in this document should be configured directly against production credentials until sandbox testing is complete.
01Tool inventory
Tool
Role in automation
Auth method
Min plan required
Used by agent(s)
Automation platform
Orchestration layer: hosts all workflow logic, credential store, and inter-agent routing
Internal (platform account)
Paid tier with webhook + API steps
All agents
Notion
NDA request tracker: creates and updates records with status, party details, and file links
OAuth 2.0 / Internal integration token
Free (API access included)
Agent 1
Google Drive
Template storage and executed copy filing: reads templates, writes populated copies, files signed PDFs
OAuth 2.0 (service account recommended)
Google Workspace (any tier)
Agents 1, 3
Slack
Internal approval routing: posts interactive approval messages with approve/reject buttons, sends 24-hour reminders
OAuth 2.0 (bot token)
Free (Block Kit + interactive messages)
Agent 2
Gmail
Outbound notifications: sends completion emails to the requester on NDA execution
OAuth 2.0 (service account or delegated)
Google Workspace (any tier)
Agent 2, 3
DocuSign
E-signature lifecycle: creates envelopes, manages sequential signing order, fires completion webhooks
OAuth 2.0 (JWT grant)
Standard or above (API access required)
Agent 3
HubSpot
CRM update: logs execution date, Drive file link, and signed NDA activity against contact or deal record
OAuth 2.0 / Private app token
Free CRM (Contacts + Deals API)
Agent 3
Before you connect anything: all integrations must be tested end-to-end in sandbox or developer environments before production credentials are entered into the credential store. DocuSign provides a dedicated demo environment at account-d.docusign.com. HubSpot sandbox accounts are available on developer portals. Notion and Google Drive connections should be tested against a dedicated test workspace and a non-production Drive folder respectively. Do not use live NDA templates or real counterparty data during testing.
02Per-tool integration detail
Notion
Used by Agent 1 (Intake and Classification Agent) to create a new NDA tracker record on each intake form submission and update that record throughout the workflow lifecycle.
Auth method
OAuth 2.0 internal integration token. Create a new internal integration in the Notion developer portal scoped to the NDA tracker database only. Store the token in the credential store as NOTION_API_TOKEN.
Required scopes
Read content (databases:read), Insert content (pages:write), Update content (pages:update). Notion internal integrations use capability flags rather than OAuth scope strings; enable 'Read content', 'Insert content', and 'Update content' in the integration settings.
Webhook / trigger setup
Not applicable as a trigger in this workflow. Notion is written to by the automation platform; no inbound webhook is required.
Required configuration
The NDA tracker database ID must be stored in the credential store as NOTION_DATABASE_ID (not hardcoded). The database must contain the following properties: NDA Type (select), Party Name (text), Requester Email (email), Status (select: Draft, Pending Approval, Sent for Signature, Executed, Rejected), Drive Draft Link (url), Drive Executed Link (url), Submission Timestamp (date), HubSpot Record ID (text).
Rate limits
Notion API enforces an average rate of 3 requests/second per integration token. At 20 NDA requests/month (roughly one request every 36 hours) throttling is not required. The platform should implement a 500 ms delay between sequential Notion API calls within a single workflow run as a defensive measure.
Constraints
The integration token only accesses databases and pages it has been explicitly shared with in the Notion UI. If the tracker database is moved or duplicated, the NOTION_DATABASE_ID must be updated. Notion does not support bulk page creation in a single API call; each record is one POST to /v1/pages.
// Input
form_submission: { party_name, nda_type, requester_email, submission_timestamp, hubspot_record_id }
// Output
notion_page_id: string // stored and passed to downstream agents for status updatesGoogle Drive
Used by Agent 1 to read the correct NDA template and write a populated draft copy, and by Agent 3 to file the executed PDF returned by DocuSign after all parties have signed.
Auth method
OAuth 2.0 service account (recommended) to avoid token expiry mid-workflow. Grant the service account 'Editor' access to the NDA Templates folder and the Executed NDAs folder. Store the service account JSON key in the credential store as GDRIVE_SERVICE_ACCOUNT_JSON.
Required scopes
https://www.googleapis.com/auth/drive.file (read and write files created by the app), https://www.googleapis.com/auth/drive.readonly (read existing template files). If a service account is used with domain-wide delegation, add https://www.googleapis.com/auth/drive.
Webhook / trigger setup
Google Drive Push Notifications (Drive API v3 watch endpoint) are not used in this workflow. Agent 1 reads templates on demand when triggered by the intake form. No inbound Drive webhook is required.
Required configuration
Store the following IDs in the credential store: GDRIVE_TEMPLATES_FOLDER_ID (parent folder containing all NDA templates), GDRIVE_EXECUTED_FOLDER_ID (destination folder for filed executed copies), GDRIVE_TEMPLATE_MUTUAL_ID (Google Doc ID for mutual NDA template), GDRIVE_TEMPLATE_ONEWAY_ID (Google Doc ID for one-way NDA template), GDRIVE_TEMPLATE_EMPLOYEE_ID (Google Doc ID for employee NDA template), GDRIVE_TEMPLATE_VENDOR_ID (Google Doc ID for vendor NDA template). Templates must use {{party_name}}, {{counterparty_name}}, {{effective_date}}, {{governing_law}}, and {{requester_name}} as merge placeholders. The executed copy filename convention is: YYYY-MM-DD_NDA_[PartyName]_[NDAType]_Executed.pdf.
Rate limits
Google Drive API enforces 1,000 requests/100 seconds per user and 10,000 requests/100 seconds per project. At 20 NDAs/month this limit is not approached. No throttling logic required beyond standard retry on 429 responses.
Constraints
Template population uses the Google Docs API (not Drive API) to perform find-and-replace on placeholder strings. Ensure the Docs API is enabled in the Google Cloud project alongside Drive API. Placeholder strings must be unique and must not span paragraph boundaries in the template document.
// Input (Agent 1 - template population)
template_id: GDRIVE_TEMPLATE_* // selected by nda_type
merge_fields: { party_name, counterparty_name, effective_date, governing_law, requester_name }
// Output (Agent 1)
draft_file_id: string // Google Doc ID of the populated draft
draft_file_url: string // View link passed to Slack approval message
// Input (Agent 3 - filing)
executed_pdf_base64: string // PDF content from DocuSign completion event
filing_metadata: { party_name, nda_type, execution_date }
// Output (Agent 3)
executed_file_url: string // Shareable Drive link to the filed executed PDFSlack
Used by Agent 2 (Approval and Routing Agent) to post an interactive Block Kit approval message to the designated approver, collect the button response, and fire a 24-hour reminder if no response is received.
Auth method
OAuth 2.0 bot token. Install a Slack app with bot user to the workspace. Store the bot token in the credential store as SLACK_BOT_TOKEN. Store the signing secret as SLACK_SIGNING_SECRET for request verification.
Required scopes
chat:write (post messages as the bot), chat:write.customize (set username and icon), incoming-webhook (optional, for simpler posting), users:read.email (look up approver Slack ID by email if not hardcoded), im:write (open DM channel to approver if posting via DM).
Webhook / trigger setup
Slack interactive components require a Request URL to be set in the Slack app configuration under 'Interactivity and Shortcuts'. The automation platform must expose a public HTTPS endpoint at a URL stored in the credential store as SLACK_INTERACTIVITY_URL. All inbound payloads to this endpoint must be verified using SLACK_SIGNING_SECRET by computing HMAC-SHA256 over the raw request body and comparing to the X-Slack-Signature header. Reject any request where the timestamp in X-Slack-Request-Timestamp is more than 300 seconds old.
Required configuration
SLACK_APPROVER_USER_ID: Slack user ID of the designated NDA approver (store in credential store, not hardcoded). SLACK_APPROVAL_CHANNEL_ID: the channel or DM target for approval messages. The Block Kit message payload must include two actions with action_id values of nda_approve and nda_reject. The message must embed the draft_file_url and the notion_page_id as metadata in the block payload so the interactivity handler can correlate the response to the correct workflow run.
Rate limits
Slack Web API Tier 3 methods (chat.postMessage) allow 50 requests/minute. At 20 NDAs/month with a maximum of 2 messages per NDA (initial + reminder) the rate limit is not a concern. No throttling required.
Constraints
If the approver responds by typing in thread rather than pressing the approve or reject button, the workflow will not advance. The runbook must instruct approvers to use the buttons. The 24-hour reminder is implemented as a timed delay step in the orchestration layer that checks whether an approval response has been received before posting the reminder message.
// Input
draft_file_url: string
notion_page_id: string
approver_user_id: SLACK_APPROVER_USER_ID
// Output (interactive callback payload)
action_id: 'nda_approve' | 'nda_reject'
notion_page_id: string // echoed from block metadata
approver_slack_id: string
Gmail
Used by Agent 2 to send a rejection notification if the approver rejects the draft, and by Agent 3 to send a completion confirmation email to the original requester with a link to the executed copy.
Auth method
OAuth 2.0 with delegated access via a Google Workspace service account, impersonating the Legal Ops sender address. Alternatively, use a standard OAuth 2.0 user token for the Legal Ops Gmail account and store the refresh token in the credential store as GMAIL_REFRESH_TOKEN. Store the sender address as GMAIL_SENDER_ADDRESS.
Required scopes
https://www.googleapis.com/auth/gmail.send (send email only; do not request broader Gmail access).
Webhook / trigger setup
Gmail is used for outbound sending only. No inbound Gmail trigger or watch is used in this workflow. The intake form is the sole entry point; Gmail Push Notifications are not required.
Required configuration
GMAIL_SENDER_ADDRESS: the From address for all automated emails. Email templates for the rejection notification and the completion email must be stored as plain-text or HTML strings in the automation platform's variable store, not hardcoded in the step configuration. The completion email must include the executed_file_url and the party_name as dynamic fields. The rejection email must include the draft_file_url so the requester can view and revise the draft.
Rate limits
Gmail API allows 250 quota units/second per user and 1,000,000 quota units/day. Sending a message costs 100 units. At a maximum of 3 emails per NDA and 20 NDAs/month the daily usage is approximately 6,000 units. No throttling required.
Constraints
The Gmail API send method requires the email to be constructed as a RFC 2822 MIME message encoded in base64url. The automation platform step must handle this encoding. SPF and DKIM records for the sender domain must be correctly configured to avoid delivery to spam.
// Input (completion email)
to: requester_email
subject: 'Your NDA with {{party_name}} is fully executed'
body_fields: { party_name, executed_file_url, execution_date }
// Input (rejection notification)
to: requester_email
subject: 'NDA draft for {{party_name}} requires revision'
body_fields: { party_name, draft_file_url, rejection_timestamp }DocuSign
Used by Agent 3 (Signature and Completion Agent) to create and send the signing envelope, enforce sequential signing order (internal signatory first, counterparty second), monitor envelope status via webhook, and deliver the completed PDF.
Auth method
OAuth 2.0 JWT Grant (server-to-server, no user interaction required). Generate an RSA key pair in the DocuSign developer console. Store the private key as DOCUSIGN_RSA_PRIVATE_KEY and the integration key as DOCUSIGN_INTEGRATION_KEY in the credential store. The JWT grant impersonates a DocuSign admin user whose user ID is stored as DOCUSIGN_IMPERSONATION_USER_ID. Use the demo environment (account-d.docusign.com) for all testing.
Required scopes
signature (create and send envelopes), impersonation (required for JWT grant when acting on behalf of a user). Both scopes must be granted by a DocuSign account admin via the OAuth consent flow before JWT tokens will be issued.
Webhook / trigger setup
Configure a DocuSign Connect webhook (Connect configuration in the DocuSign admin console) to POST envelope status events to a public HTTPS endpoint on the automation platform, stored as DOCUSIGN_WEBHOOK_URL. Subscribe to the following envelope events: envelope-sent, envelope-delivered, envelope-completed, envelope-declined, envelope-voided. Validate inbound payloads using the HMAC-SHA256 signature in the X-DocuSign-Signature-1 header against DOCUSIGN_HMAC_KEY stored in the credential store.
Required configuration
DOCUSIGN_ACCOUNT_ID: the production account GUID. DOCUSIGN_BASE_URL: https://na4.docusign.net/restapi (confirm the correct shard for the account). DOCUSIGN_TEMPLATE_MUTUAL_ID, DOCUSIGN_TEMPLATE_ONEWAY_ID, DOCUSIGN_TEMPLATE_EMPLOYEE_ID, DOCUSIGN_TEMPLATE_VENDOR_ID: template IDs for each NDA type (templates must be pre-configured in DocuSign admin with signer roles 'Internal Signatory' and 'Counterparty'). DOCUSIGN_INTERNAL_SIGNER_EMAIL and DOCUSIGN_INTERNAL_SIGNER_NAME: the default internal signatory. DOCUSIGN_HMAC_KEY: the secret used to validate Connect webhook payloads. All IDs and secrets stored in the credential store; none hardcoded.
Rate limits
DocuSign Standard plan allows 1,500 API calls/hour. At 20 NDAs/month with approximately 5 API calls per envelope (create, send, status poll fallback, download completed PDF, void if expired) the hourly burst never exceeds 10 calls. No throttling required. If the account is on a metered plan, envelope sends are counted against the monthly allowance; confirm the plan's envelope limit before go-live.
Constraints
DocuSign templates must be fully configured with tab positions and signer roles before the automation can use them. Template setup requires a DocuSign admin and is a pre-build prerequisite. Sequential signing order is enforced by setting routingOrder: 1 for the internal signatory and routingOrder: 2 for the counterparty in the envelope recipient list. Counterparty redlines (when the counterparty returns a modified document) are not handled by the automation; the workflow must pause and route to a human reviewer via Slack in this scenario.
// Input (create envelope)
template_id: DOCUSIGN_TEMPLATE_* // selected by nda_type
signers: [
{ role: 'Internal Signatory', email: DOCUSIGN_INTERNAL_SIGNER_EMAIL, name: DOCUSIGN_INTERNAL_SIGNER_NAME, routingOrder: 1 },
{ role: 'Counterparty', email: counterparty_email, name: counterparty_name, routingOrder: 2 }
]
envelope_subject: 'NDA for signature: {{party_name}}'
// Output (Connect webhook - completion event)
envelope_id: string
status: 'completed'
completed_at: ISO8601 timestamp
documents[0].documentBase64: string // executed PDF contentHubSpot
Used by Agent 3 to update the associated contact or deal record in HubSpot with the execution date, the Drive link to the filed executed copy, and a signed NDA activity note.
Auth method
Private app token (recommended over legacy API keys). Create a private app in HubSpot Settings under Integrations. Store the access token in the credential store as HUBSPOT_PRIVATE_APP_TOKEN. No OAuth redirect flow is required for a private app.
Required scopes
crm.objects.contacts.read, crm.objects.contacts.write, crm.objects.deals.read, crm.objects.deals.write, crm.objects.notes.write (to log the signed NDA activity as a note associated with the contact or deal).
Webhook / trigger setup
HubSpot is not a trigger source in this workflow. The automation platform calls the HubSpot API outbound on completion of the DocuSign envelope. No inbound HubSpot webhook is required.
Required configuration
The HubSpot record ID (contact ID or deal ID) must be captured at intake form submission and stored in the Notion record as hubspot_record_id. The automation platform passes this ID to Agent 3. The custom contact/deal properties nda_executed_date (date) and nda_drive_link (text) must be created in HubSpot before go-live and their internal property names stored in the credential store as HUBSPOT_PROP_NDA_DATE and HUBSPOT_PROP_NDA_LINK. The activity note body should follow the template: 'NDA executed on {{execution_date}} with {{party_name}}. Filed copy: {{executed_file_url}}'.
Rate limits
HubSpot API enforces 150 requests/10 seconds and 100 requests/10 seconds on some endpoints for free CRM accounts. A single NDA completion triggers 2 API calls (PATCH contact or deal + POST note). At 20 NDAs/month this is negligible. Implement exponential backoff on 429 responses as a standard defensive measure.
Constraints
The HubSpot record ID must be provided at intake; if a requester does not link the NDA to an existing HubSpot contact or deal, the HubSpot update step must be skipped gracefully with a warning logged to the platform run log rather than failing the workflow. The private app token does not expire but must be rotated if the HubSpot portal ownership changes.
// Input
hubspot_record_type: 'contact' | 'deal'
hubspot_record_id: string // from Notion record
patch_properties: { nda_executed_date: 'YYYY-MM-DD', nda_drive_link: executed_file_url }
note_body: string // templated activity note
// Output
hubspot_update_status: 200 | 204 // confirm success
note_id: string // HubSpot engagement ID for the logged noteIntegration and API SpecPage 1 of 3
FS-DOC-05Technical
03Field mappings between tools
The tables below define every field that crosses a tool boundary at each agent handoff. Use the exact field names shown when configuring data mapping steps in the automation platform. All names are case-sensitive.
Agent 1 handoff: Intake form to Notion tracker (Intake and Classification Agent)
Source tool
Source field
Destination tool
Destination field
Intake form
`form.party_name`
Notion
`properties.Party Name`
Intake form
`form.counterparty_email`
Notion
`properties.Requester Email`
Intake form
`form.nda_type`
Notion
`properties.NDA Type`
Intake form
`form.hubspot_record_id`
Notion
`properties.HubSpot Record ID`
Intake form
`form.submitted_at`
Notion
`properties.Submission Timestamp`
Automation platform
`'Draft'` (literal)
Notion
`properties.Status`
Agent 1 handoff: Intake form to Google Drive template population (Intake and Classification Agent)
Source tool
Source field
Destination tool
Destination field
Intake form
`form.party_name`
Google Drive (Docs API)
`replaceText.{{party_name}}`
Intake form
`form.counterparty_name`
Google Drive (Docs API)
`replaceText.{{counterparty_name}}`
Intake form
`form.governing_law`
Google Drive (Docs API)
`replaceText.{{governing_law}}`
Intake form
`form.requester_name`
Google Drive (Docs API)
`replaceText.{{requester_name}}`
Automation platform
`current_date` (ISO 8601)
Google Drive (Docs API)
`replaceText.{{effective_date}}`
Automation platform
`nda_type` (classification output)
Google Drive
`fileId` (template selected from GDRIVE_TEMPLATE_* store)
Agent 1 to Agent 2 handoff: Google Drive draft to Slack approval message (Approval and Routing Agent)
Source tool
Source field
Destination tool
Destination field
Google Drive
`file.webViewLink`
Slack
`blocks[].text` (draft link in message body)
Notion
`page.id`
Slack
`blocks[].accessory.value` (block metadata for callback correlation)
Intake form
`form.party_name`
Slack
`blocks[].text` (displayed in approval message header)
Intake form
`form.nda_type`
Slack
`blocks[].text` (NDA type label in message body)
Agent 2 to Agent 3 handoff: Slack approval callback to DocuSign envelope creation (Signature and Completion Agent)
Source tool
Source field
Destination tool
Destination field
Slack callback
`payload.actions[0].action_id`
Automation platform
`branch_condition` (approve vs. reject routing)
Slack callback
`payload.actions[0].value` (notion_page_id)
Notion
`page.id` (status update to 'Sent for Signature')
Google Drive
`file.id` (approved draft)
DocuSign
`documents[0].documentBase64` (PDF export of draft)
Intake form
`form.counterparty_email`
DocuSign
`recipients.signers[1].email`
Intake form
`form.counterparty_name`
DocuSign
`recipients.signers[1].name`
Credential store
`DOCUSIGN_INTERNAL_SIGNER_EMAIL`
DocuSign
`recipients.signers[0].email`
Credential store
`DOCUSIGN_INTERNAL_SIGNER_NAME`
DocuSign
`recipients.signers[0].name`
Intake form
`form.party_name`
DocuSign
`emailSubject` (envelope subject line)
Agent 3 internal handoff: DocuSign completion to Google Drive filing and HubSpot update (Signature and Completion Agent)
Source tool
Source field
Destination tool
Destination field
DocuSign webhook
`envelopeId`
Notion
`properties.DocuSign Envelope ID`
DocuSign webhook
`completedDateTime`
Notion
`properties.Execution Date`
DocuSign webhook
`documents[0].documentBase64`
Google Drive
`file.content` (uploaded as PDF to GDRIVE_EXECUTED_FOLDER_ID)
Google Drive
`file.webViewLink`
Notion
`properties.Drive Executed Link`
Google Drive
`file.webViewLink`
HubSpot
`properties.nda_drive_link`
DocuSign webhook
`completedDateTime`
HubSpot
`properties.nda_executed_date`
Google Drive
`file.webViewLink`
Gmail
`body_fields.executed_file_url` (completion email)
Intake form
`form.requester_email`
Gmail
`to` (completion email recipient)
Intake form
`form.party_name`
Gmail
`body_fields.party_name` (completion email body)
04Build stack and orchestration
Orchestration layout
Three discrete workflows, one per agent: (1) Intake and Classification Workflow, (2) Approval and Routing Workflow, (3) Signature and Completion Workflow. All three workflows share a single credential store. Inter-workflow communication is handled via the Notion record (notion_page_id as the shared correlation key) and direct workflow trigger calls where supported by the platform.
Agent 1 trigger mechanism
Webhook trigger. The intake form posts a JSON payload to a public HTTPS endpoint on the automation platform on submission. The endpoint URL is stored as INTAKE_WEBHOOK_URL. The platform verifies the request using a shared secret header (X-Form-Secret matching INTAKE_WEBHOOK_SECRET in the credential store). Poll-based triggers are not used for Agent 1.
Agent 2 trigger mechanism
Triggered directly by Agent 1 via an internal workflow call on successful Notion record creation and Google Drive draft population. Additionally triggered by the Slack interactive component callback endpoint (SLACK_INTERACTIVITY_URL) when the approver clicks approve or reject. Signature validation on the Slack payload uses SLACK_SIGNING_SECRET (HMAC-SHA256, see section 02). The 24-hour reminder sub-step uses a timed delay node within the Agent 2 workflow, not a separate scheduled poll.
Agent 3 trigger mechanism
Triggered by two events: (a) Slack approval callback received with action_id = nda_approve, passed from Agent 2 via internal workflow call; (b) DocuSign Connect webhook POST to DOCUSIGN_WEBHOOK_URL with status = envelope-completed. The DocuSign webhook payload is validated using HMAC-SHA256 against DOCUSIGN_HMAC_KEY before any action is taken. The envelope_id from the webhook is used to correlate the event to the correct Notion record and workflow run.
Credential store
All secrets, IDs, and tokens are stored in the automation platform's native encrypted credential store. No credentials appear in workflow step configurations, code nodes, or log outputs. See the code block below for the full list.
All credential store entries must be populated before any workflow is activated. Never store these values in workflow step fields or environment variable comments.
// Credential store contents (NDA Workflow)
// All entries are encrypted at rest in the automation platform credential store
// Intake form
INTAKE_WEBHOOK_SECRET // shared secret for intake form webhook validation
// Notion
NOTION_API_TOKEN // internal integration token
NOTION_DATABASE_ID // NDA tracker database GUID
// Google Drive / Docs (service account)
GDRIVE_SERVICE_ACCOUNT_JSON // full service account key JSON
GDRIVE_TEMPLATES_FOLDER_ID // parent folder for NDA templates
GDRIVE_EXECUTED_FOLDER_ID // destination folder for executed PDFs
GDRIVE_TEMPLATE_MUTUAL_ID // Google Doc ID - mutual NDA template
GDRIVE_TEMPLATE_ONEWAY_ID // Google Doc ID - one-way NDA template
GDRIVE_TEMPLATE_EMPLOYEE_ID // Google Doc ID - employee NDA template
GDRIVE_TEMPLATE_VENDOR_ID // Google Doc ID - vendor NDA template
// Slack
SLACK_BOT_TOKEN // xoxb-... bot token
SLACK_SIGNING_SECRET // used to validate interactive component payloads
SLACK_APPROVER_USER_ID // Slack user ID of the NDA approver
SLACK_APPROVAL_CHANNEL_ID // DM or channel ID for approval messages
SLACK_INTERACTIVITY_URL // public HTTPS endpoint for Slack interactive callbacks
// Gmail
GMAIL_REFRESH_TOKEN // OAuth refresh token for the sending account
GMAIL_CLIENT_ID // OAuth client ID
GMAIL_CLIENT_SECRET // OAuth client secret
GMAIL_SENDER_ADDRESS // From address for all automated emails
// DocuSign
DOCUSIGN_INTEGRATION_KEY // app integration key (client ID)
DOCUSIGN_RSA_PRIVATE_KEY // RSA private key for JWT grant
DOCUSIGN_IMPERSONATION_USER_ID // DocuSign user GUID to impersonate
DOCUSIGN_ACCOUNT_ID // production account GUID
DOCUSIGN_BASE_URL // e.g. https://na4.docusign.net/restapi
DOCUSIGN_WEBHOOK_URL // public HTTPS endpoint for Connect events
DOCUSIGN_HMAC_KEY // secret for Connect payload HMAC validation
DOCUSIGN_TEMPLATE_MUTUAL_ID // DocuSign template ID - mutual NDA
DOCUSIGN_TEMPLATE_ONEWAY_ID // DocuSign template ID - one-way NDA
DOCUSIGN_TEMPLATE_EMPLOYEE_ID // DocuSign template ID - employee NDA
DOCUSIGN_TEMPLATE_VENDOR_ID // DocuSign template ID - vendor NDA
DOCUSIGN_INTERNAL_SIGNER_EMAIL // email of the internal signatory
DOCUSIGN_INTERNAL_SIGNER_NAME // display name of the internal signatory
// HubSpot
HUBSPOT_PRIVATE_APP_TOKEN // private app access token
HUBSPOT_PROP_NDA_DATE // internal property name for execution date
HUBSPOT_PROP_NDA_LINK // internal property name for Drive file link
Integration and API SpecPage 2 of 3
FS-DOC-05Technical
05Error handling and retry logic
Unhandled exceptions must never fail silently. Every integration point has a defined failure behaviour. Where a step cannot complete after retries, the workflow must log the error to the platform run log, update the Notion record status to 'Error', and post a failure alert to the designated Slack operations channel (SLACK_OPS_CHANNEL_ID) with the notion_page_id, the failed step name, and the error message. The requester must not be notified of internal errors automatically; a human must review and decide the next action.
Integration
Scenario
Required behaviour
Intake webhook
Intake form POST fails to reach the automation platform (network error or platform downtime)
The intake form provider must be configured to retry the POST up to 3 times with a 60-second interval. If all retries fail, the form submission is queued and the requester sees a generic error. The FullSpec team must monitor platform uptime and configure a status-page alert.
Notion API
Page creation fails with a 4xx or 5xx response
Retry up to 3 times with exponential backoff (5s, 15s, 45s). If all retries fail, halt the workflow, log the error, and post a Slack alert to SLACK_OPS_CHANNEL_ID. Do not proceed to Google Drive template population without a confirmed Notion page ID.
Google Drive (Docs API)
Template population fails because a placeholder string is not found in the document
Log a warning per missing placeholder but do not halt the workflow. Flag the draft as 'Incomplete merge' in the Notion record status. Post a Slack alert listing the missing placeholders so the template owner can correct the template. Retry is not applicable; the root cause is a template configuration issue.
Google Drive (Docs API)
Copy creation or file write returns a 403 Forbidden error
Retry once after 10 seconds. If the error persists, halt the workflow and post a Slack alert. The most likely cause is the service account losing access to the target folder; the FullSpec team must verify Drive sharing permissions. Do not proceed to the Slack approval step without a valid draft file URL.
Slack (approval message)
chat.postMessage call returns a not_in_channel or channel_not_found error
Retry once. If the error persists, fall back to sending the approval request via Gmail to the approver's email address (APPROVER_EMAIL stored in the credential store) with the draft link. Update the Notion record to note that email fallback was used. Log the Slack error.
Slack (interactive callback)
No approval or rejection response is received within 24 hours
The workflow posts a single reminder message to SLACK_APPROVER_USER_ID after the 24-hour timed delay. If no response is received within a further 24 hours (48 hours total), the workflow pauses, updates the Notion status to 'Approval Overdue', and posts an escalation alert to SLACK_OPS_CHANNEL_ID. The workflow does not auto-approve or auto-reject under any condition.
Slack (interactive callback)
Inbound callback payload fails HMAC-SHA256 signature validation
Reject the request immediately with HTTP 400. Log the invalid payload and the source IP. Do not advance the workflow. If repeated invalid requests are detected, post an alert to SLACK_OPS_CHANNEL_ID as this may indicate a replay or spoofing attempt.
DocuSign (envelope creation)
Envelope creation API call returns a 400 or 401 error
On 401: attempt to refresh the JWT access token and retry the API call once. On 400: log the full error body, update Notion status to 'DocuSign Error', and post a Slack alert. Do not retry 400 errors automatically as they indicate a configuration issue (template ID mismatch, invalid recipient email, etc.) that requires human intervention.
DocuSign (Connect webhook)
Completion webhook payload fails HMAC validation or arrives with an unrecognised envelope_id
Reject with HTTP 400 and log the anomaly. If the envelope_id is not found in the Notion database, post a Slack alert. Do not file any document or update HubSpot. The FullSpec team must investigate manually using the DocuSign admin console.
DocuSign (envelope monitoring)
Envelope expires without all parties signing (default DocuSign expiry: 120 days, recommended: 14 days for NDAs)
The DocuSign envelope-voided webhook event triggers a Notion status update to 'Envelope Expired'. A Slack alert is posted to SLACK_OPS_CHANNEL_ID with the party name and envelope ID. The requester is not automatically notified; a human must decide whether to resend. Configure the envelope expiry reminder in DocuSign to fire at 3 days before expiry.
HubSpot API
PATCH contact or deal returns 404 (record not found) or 401 (token invalid)
On 404: skip the HubSpot update step, log a warning, and continue the workflow (file the NDA and send the completion email as normal). Post a Slack alert noting that the HubSpot record ID was not found so a human can update it manually. On 401: retry once after token verification; if it persists, alert the ops channel and skip the step gracefully.
Gmail (completion email)
Gmail API send call fails with a 5xx error
Retry up to 3 times with exponential backoff (10s, 30s, 90s). If all retries fail, log the error and post a Slack alert to SLACK_OPS_CHANNEL_ID with the requester email and the executed file URL so the ops team can send the notification manually. Do not leave the requester without any notification.
Support contact: For credential failures, webhook delivery issues, or integration errors that cannot be resolved from this spec, contact the FullSpec team at support@gofullspec.com with the workflow run ID and the Notion page ID of the affected NDA record.
Integration and API SpecPage 3 of 3